1
Chapter 8:GSM Mobility Management
Prof. Yuh-Shyan ChenDepartment of Computer Science and
Information Engineering National Taipei University
Nov. 2006
Wireless and Mobile Network Architecture
2
Outline
IntroductionGSM Location UpdateMobility DatabasesFailure RestorationVLR Identification AlgorithmVLR Overflow ControlSummary
3
Introduction
GSM networks track the locations of the MSsso that incoming calls can be delivered to the subscribersA mobile service area is partitioned into several location area (LAs) or registration areasLA consists of a group of base transceiver stations (BTSs) that communicate with the MSs over radio links
4
Fig. 11.1 GSM location area hierarchy
5
Cont.
Location update procedure (registration): BTSs periodically broadcast the correspondingLA address to the MSs. When an MS receives an LA address different from the one stored in its memory, it sends a registration message to the networkLocation information
VLRLA address: temporary record
HLRThe last VLR visited by MS: permanent record
6
Cont.
GSM location area hierarchy (Fig. 11.1)Fault tolerance
Location database failure degrade the service offered to the subscribersFault restoration procedure
Database overflow: If VLR is full when a mobile user arrives, the user fails to “register”
7
11.1 GSM Location Update
In GSM, registration or location update occurs when an MS moves from one LA to another
8
11.1.1 Basic Location Update Procedure
Basic Location Update ProcedureInter- LA MovementInter- MSC Movementinter- VLR Movement
MS cannot distinguish the types of movement
9
Fig. 11.1 GSM location area hierarchy
10
11.1.1.1 Inter-LA Movement
The MS moves from LA1 to LA2, where both LAs are connected to the same MSC (Fig. 11.2)Step 1.
A location update request message is sent from the MS to the MSC through the BTS, include the address of the previously visited LA, MSC, and VLRTMSI is used to avoid sending the IMSI on the radio path
11
Fig. 11.2 Inter-LA registration message flow
12
Cont.
Step 2.The MSC forwards the location update request to the VLR by a TCAP message, MAP_UPDATE_LOCATION_AREA
Address of the MSCTMSI of the MSPrevious location area identification (LAI)Target LAIOther related information listed in Section 6.1.1 of GSM 09.02 and GSM 03.12
13
Fig. 11.2 Inter-LA registration message flow
14
Cont.
Step 3 and Step 4.MSC updates the LAI field of the VLR record, and replies with an acknowledgment to the MS through the MSC
15
11.1.1.2 Inter-MSC Movement
Two LAs belong to different MSCs of the same VLR (Fig. 11.3)Steps 1 and 2.
The location update request is sent from the MS to the VLR
16
Fig. 11.3 Inter-MSC registration message flow
17
Cont.
Step 3.VLR updates the LAI and the MSC fields of VLR record, and derives the HLR address of the MS from the MS’s IMSIVLR sends the MAP_UPDATE_LOCATIONmessage to the HLR
IMSI of the MSAddress of the target MSC (i.e., MSC2)Address of the target VLR (i.e., VLR1)Other related information, as listed in Section 6.1.2 of GSM 09.02
18
Fig. 11.3 Inter-MSC registration message flow
19
Cont.
Step 4.HLR identifies the MS’s record by using the received IMSIMSC number field is updatedAn acknowledgment is sent to the VLR
Step 5 and 6. Similar to steps 3 and 4 in 11.1.1.1
20
11.1.1.3 Inter-VLR Movement
Two LAs belong to MSCs connected to different VLRs (Fig 11.4)Step 1.
Location update request is sent from MS to VLRStep 2 and 3.
VLR2 identifies address of the previous VLR(VLR1), then sends the message MAP_SEND_IDENTIFICATION to VLR1
TMSIVLR1 sends IMSI to VLR2
21
Fig. 11.4 Inter-VLR registration message flow
22
Cont.
Step 4 and 5.VLR2 creates a VLR record for the MS, and sends a registration message to update the HLRHLR updates MSC and VLR address field of the recordAn acknowledgment is sent back to VLR2
Step 6.VLR2 generates a new TMSI and sends it to the MS
Step 7 and 8.The obsolete record of the MS in VLR1 is delete
23
Fig. 11.4 Inter-VLR registration message flow
24
11.1.2 Basic call Origination and Termination Procedures
Fig 11.5 illustrates the basic call origination procedureStep 1. MSu1 sends the call origination request to the MSCStep 2. MSC forwards the request to VLR by sending MAP_SEND_INFO_FOR_OUTGOING_CALL
25
Cont.
Step 3. VLR checks u1’s profile and sends MAP_SEND_INFO_FOR_OUTGOING_CALL_ack to MSC to grant the call requestStep 4. MSC sets up the trunk according to the standard PSTN call setup procedure
26
Fig. 11.5
27
Call Termination
For call termination to a GSM subscriber, routing information must be obtained from the serving VLR (Fig. 11.6)Step 1. When mobile station ISDN number (MSISDN) is dialed by a PSTN user, the call is routed to a gateway MSC by SS7 ISUP IAM message.Step 2. GMSC or ISDN exchange sends MAP_SEND_ROUTING_INFOMATION to HLR to obtain routing information, include:
MSISDNOther related information
28
Cont.
Step 3. HLR sends MAP_PROVIDE_ROAMING_NUMBERmessage to VLR to obtain mobile subscriber roaming number (MSRN), include:
IMSIMSC number
29
Cont.
Steps 4 and 5. VLR creates MSRN by using MSC number storeed in the VLR record of the MS, and sends it back to GMSC through the HLRStep 6. An SS7 ISUP IAM message is directed from the GMSC to the target MSC to set up the voice trunk
30
Fig. 11.6 Call termination message flow
31
11.2 Mobility Databases
Home location register (HLR) is a database used for mobile user information management. All permanent subscriber data are stored in this database.
32
Cont.
An HLR record consists of 3 types of information:
Mobile station informationIMSI used by MS to access networkMSISDN
Location informationISDN number (address) of VLR and MSC where MS resides
Service informationService subscriptionService restrictionsSupplementary services
33
Cont.
Visitor location register (VLR) is a database of the service area visited by MS. All subscriber data of an MS required for call handling and other purpose are stored in VLR. VLR information consists of 3 parts:
Mobile station informationIMSIMSISDNTMSI
34
Cont.
Location informationMSC numberLocation area ID (LAI)
Service informationSubset of the service information stored in the HLR
35
11.3 Failure Restoration11.3.1 VLR Failure Restoration
VLR failure restorationService information: recovered by first contact between VLR and HLRLocation information: recovered by first radio contact between VLR and MSMobile station information: recovered either by contact with HLR or MS
36
Cont.
VLR record restoration is initiated by one of the three events
MS registrationMS call originationMS call termination
37
Cont.
MS registrationVLR considers the registration as inter-VLR movement because VLR record was erased by failureVLR record is recovered from normal inter-VLR movement
MS is asked to send IMSI over the air because TMSI send from MS to the VLR cannot be recognized
38
Cont.
MS call originationVLR received the call origination request from MSC.Because the VLR record for MS is not found, VLR considers the situation as a system error “unidentified subscriber”. The request is rejected, and MS is asked to initiate location registration procedure
39
Cont.
MS call termination (Fig. 11.7)Steps 1-3.
Similar to the first three steps of basic call termination procedure, VLR is queried to provide the MSRN.Because searching for MS record by using IMSI fails, VLR creates a VLR record for MSNeither service nor location information is available, Steps 4 and 5 are executed in parallel
40
Cont.
Steps 4 and 7.VLR create MSRN using MSC number provide by MAP_PROVIDE_ROAMING_NUMBER message. MSRN is sent back to GMSC to set up call in step 8
Steps 5 and 6.VLR recovers service information of VLR record by sending MAP_RESTORE_DATA message to HLRHLR sends the service information to VLR using MAP_INSERT_SUBSCRIBER_DATA messageLocation information, specially LAI number will be recovered at step 11
41
Cont.
Step 8.GMSC sends SS7 ISUP message IAM to target MSC
Steps 9-11.MSC sends message MAP_SEND_INFO_FOR_INCOMING_CALL to VLR to obtain LAI informationVLR does not have LAI information, and sends MAP_SEARCH_FOR_MOBILE_SUBSCRIBER to MSC to determine the LA of the MSMSC initiates paging of the MS in all LAs
42
Cont.
Steps 12 and 13.If paging is successful, the current LA address of the MS is sent back to VLR by MAP_PROCESS_ACCESS_REQUEST message
MAP_SEARCH_FOR_MOBILE_SUBSCRIBER is expensive because every BTS connected to the MSC must perform the paging operation
43
Fig. 11.7 Call termination message flow (failure restoration)
44
11.3.2 HLR Failure Restoration
HLR is mandatory to save updates into nonvolatile storage
Changes of service information are saved into backup storage device immediately after any updateLocation information is periodically check-pointed(transferred into backup)
After an HLR failure, the data in the backup are reloaded into the HLR
45
Cont.
Uncovered period: time interval after the last backup operation and before the restart of the HLRDate that have been changed in the uncovered period cannot be recovered
46
Cont.
HLR restoration procedure (Fig. 11.8)Step 1. HLR sends SS7 TCAP message MAP_RESET to VLRsStep 2. All the VLRs derive MSs of the HLR. Then MSs send SS7 TCAP message MAP_UPDATE_LOCATION to the HLR and HLR record is recoveredHLR restoration procedure is not robust
47
Fig. 11.8 HLR restoration procedure
48
11.4 VLR Identification Algorithm
VLR Identification Algorithm (VIA): an algorithm to identify the exact VLRs to be contacted by HLR after an HLR failure
49
Cont.
Extra data structures required in the HLR (Fig 11.9)
VLR_List*: In the backup. A set of VLRs that have been modified during the uncovered periodts field: last time of location updatePVLR: address of the VLR where the MS resided at the last check-pointing time. For any MS p:
HLR*[p].VLR=HLR[p].PVLRTS: last check-pointing time
50
Cont.
VLR_Counter: a set of (VLR, Count) pairsCount: “effective number” of MSs entering the VLR VLR during uncovered periodVLRs recorded in VLR_Counter are the VLRs in VLR_List*
An MS is not effective to a VLR if it entered the VLR area then left the area during the uncovered period
51
Fig. 11.9 HLR architecture
52
Cont.
VIA Procedure 1: Check-pointingStep 1. For every location entry p in HLR* do:
HLR[p]*.VLR←HLR[p].PVLR;Step 2. TS ← current time;Step 3. For every location entry p in HLR do:
HLR[p].ts← TS; HLR[p].PVLR←HLR[p].VLR;Step 4. VLR_Counter← null, VLR_List*← null
At step 4, both VLR_Counter and VLR_List*are set to empty to indicate that no VLR has new roaming MS at TS
53
Cont.
Suppose that MS p moves into VLR area Vnew
at time t. The message MAP_UPDATE_LOCATIONis sent from Vnew to the HLR. Procedure 2 at HLR is triggered to perform the registration operation
54
Cont.
VIA Procedure 2: RegistrationStep 1. Update HLR:
Vold ← HLR[p].VLR;Send message, MAP_CANCEL_LOCATION,
to cancel the VLR entry of p at Vold:
HLR[p].VLR ← Vnew;told← HLR[p].tsHLR[p].ts ← t
55
Cont.
Step 2. Update the Vnew Count field in VLR_Counter:
If HLR[p].VLR != HLR[p].PVLR then:Step 2.1 If VLR_Counter[Vnew] exists, then:VLR_Counter[Vnew] ← VLR_Counter[Vnew] +1;Step 2.2 Else create VLR_Counter[Vnew] and
VLR_List*[Vnew] ;VLR_Counter[Vnew] ←1
56
Cont.
Step 3. Update the Vold counter entry: If told
>TS and Vold!=HLP[p].PVLR then:Step 3.1
VLR_Counter[Vold] ← VLR_Counter[Vold] -1;Step 3.2
If VLR_Counter[Vold] .Count = 0 then:Step 3.2.1
Delete VLR_Counter[Vold] and VLR_List*[Vold]
57
Cont.
After an HLR failure, procedure 3 is executed to restore the HLRVIA Procedure 3: RestoreStep 1. TS ← current time;Step 2. For every location entry p in HLR do:
HLR[p].PVLR=HLR[p].VLR ←HLR[p]*.VLR;HLR[p].ts ← TS;
Step 3. For every VLR entry V in VLR_List*, send an SS7 TCAP
MAP_RESET message to V;
58
11.5 VLR Overflow Control
When a VLR is full, the incoming mobile users cannot receive cellular servicesTo solve VLR overflow problem, overflow control algorithms O-I, O-II, O-III, and O-IV are presentedAn extra flag (1 bit) is required in the HLR records
59
11.5.1 Algorithm O-I: Registration (Fig. 11.10)
Step 1. Registration Request:Step 1.1 Same as step 1 of the normal registration procedureStep 1.2 V2 is full. V2 follows a replacement policy to select a record to be deleted (u2 in Fig.11.10). The storage for the delete record is used to store u1’s information. The selected user (i.e., u3) is called overflow user. The replacement policy may be based on various heuristicsStep 1.3 V2 forwards the registration request to the HLR with indication that u3’s record is delete due to database overflow
60
Cont.
Step 2. Registration Response:Step 2.1 HLR update the location of u1, and sets the overflow flag in u3’s recordStep 2.2 HLR acknowledges the registration operation and sends u1’s profile to V2.Step 2.3 V2 sends an acknowledgment to MS
61
Fig. 11.10 Overflow registration operation
62
11.5.2 Algorithm O-II: Cancellation (Fig. 11.11)
If u1 is an overflow user at V1, then u1 does not have a record in V1Cancellation operation simply resets the overflow flag of u1’s HLR record if u1 is not an overflow user in V2
63
Fig. 11.11 Cancellation operation with overflow VLR
64
11.5.3 Algorithm O-III: Call Origination (Fig 11.12)
Step 1. The MS sends the call origination request to V2Step 2. V2 cannot fine u1’s record, and denies the call requestSteps 3 and 4. The MS initiates the registration procedure; Algorithm O-I is executedSteps 5 and 6. The MS reissues the call origination request, and the normal call origination procedure is executed
65
Fig. 11.12 Call origination with overflow VLR
66
11.5.4 Algorithm O-IV: Call Termination (Fig. 11.13)
Step 1. Location query:Step 1.1. The calling party dials the phone number of u1. The request is sent to the origination switch in the PSTNStep 1.2. The origination switch sends a location query message to the HLRStep 1.3. The HLR determines that u1 is an overflow user and sends a query message to obtain the routing information. The use profile information is attached in the message
67
Cont.
Step 2. Location response:Step 2.1. If V2 is not full, a record for u1 is created. If V2 is full, a user record is deleted and is used to store u1 and sends it back to HLR. V2 creates the routable address of u1 and sends it back to the HLR. If a record is replaced, the replacement information is included in the messageStep 2.2. HLR returns the routable address to the originating switch. If a record is replaced, the overflow flags are updated at the HLRStep 2.3. The origination switch sets up the trunk to the MSC based on the routable addressStep 2.4. The MSC pages the mobile phone and the call path is established
68
Cont.
With Algorithms O-I through O-IV, an LA can accommodate an unlimited number of mobile users as long as the number of simultaneous phone calls to these users is no larger than the size of the database
69
Fig. 11.13 Call termination with overflow VLR
70
Summary
MS registration procedureCall delivery procedureLocation database failure restoration procedureVLR identification algorithmVLR overflow mechanism